Cross site lab #4495
Cross site lab #4495
Conversation
WalkthroughAdds a Django management command to seed eight Cross-Site Scripting (XSS) lab tasks, updates the task detail template to render lab-specific simulation payload inputs (including XSS), removes the Previous/Next navigation block from the template, and removes a few non-functional comments. Changes
Sequence Diagram(s)sequenceDiagram
actor Admin
participant CLI as manage.py
participant Command as create_xss_tasks.py
participant ORM as Django ORM
participant DB as Database
Admin->>CLI: python manage.py create_xss_tasks
CLI->>Command: run handle()
Command->>ORM: get Lab(name="Cross-Site Scripting (XSS)")
ORM->>DB: SELECT lab
DB-->>ORM: Lab instance or None
alt Lab not found
Command-->>Admin: print error and exit
else Lab found
loop for each predefined task
Command->>ORM: get_or_create Task(lab,name,order)
ORM->>DB: SELECT/INSERT task
ORM-->>Command: Task instance
Command->>ORM: update_or_create TaskContent by task
ORM->>DB: SELECT/UPDATE/INSERT content
ORM-->>Command: TaskContent instance
Command-->>Admin: print status
end
Command->>ORM: lab.update_total_tasks()
ORM->>DB: UPDATE lab.total_tasks
DB-->>ORM: OK
Command-->>Admin: print final task count
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (3)
website/templates/task_detail.html (2)
126-147: Decouple UI logic fromlab.name; key off simulation type insteadString-matching on
lab.nameis brittle (renames, i18n). Prefer usingcontent.simulation_config.typeto drive the XSS payload prompt, with SQL Injection as a fallback.Apply this diff to make the prompt resilient to lab renames:
- {% if lab.name == "SQL Injection" %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your SQL injection payload:</label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="Enter your SQL injection payload here..."></textarea> - {% elif lab.name == "Cross-Site Scripting (XSS)" %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your XSS payload:</label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="Enter your XSS payload here... (e.g., <script>alert('XSS')</script>)"></textarea> - {% else %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your payload:</label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="Enter your payload here..."></textarea> - {% endif %} + {% with sim_type=content.simulation_config.type %} + {% if sim_type == 'reflected_xss' or sim_type == 'stored_xss' or sim_type == 'dom_xss' or sim_type == 'filter_bypass' or sim_type == 'cookie_theft' %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your XSS payload:</label> + <textarea id="payload" + name="payload" + rows="4" + class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" + placeholder="Enter your XSS payload here... (e.g., <script>alert('XSS')</script>)"></textarea> + {% elif lab.name == "SQL Injection" %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your SQL injection payload:</label> + <textarea id="payload" + name="payload" + rows="4" + class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" + placeholder="Enter your SQL injection payload here..."></textarea> + {% else %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your payload:</label> + <textarea id="payload" + name="payload" + rows="4" + class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" + placeholder="Enter your payload here..."></textarea> + {% endif %} + {% endwith %}
169-169: Remove empty navigation containerThis empty div renders extra spacing but no content. Either restore the previous/next links or remove it.
Apply this diff to remove the empty container:
- <div class="mt-8 flex justify-between"></div>website/management/commands/create_xss_tasks.py (1)
255-265: Prefer update_or_create keyed by (lab, name) to avoid accidental duplicates when order changesKeying get_or_create by both name and order makes the seed non-idempotent if you reorder tasks later; it can create a second row and potentially violate the unique (lab, order) constraint.
- task, created = Tasks.objects.get_or_create( - lab=xss_lab, - name=task_data["name"], - order=task_data["order"], - defaults={ - "description": task_data["description"], - "task_type": task_data["task_type"], - "is_active": True, - }, - ) + task, created = Tasks.objects.update_or_create( + lab=xss_lab, + name=task_data["name"], + defaults={ + "order": task_data["order"], + "description": task_data["description"], + "task_type": task_data["task_type"], + "is_active": True, + }, + )Note: if the new order collides with an existing task’s order, you’ll still hit the (lab, order) uniqueness constraint—this refactor avoids silent duplication by name, not conflicts by order.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting
📒 Files selected for processing (2)
website/management/commands/create_xss_tasks.py(1 hunks)website/templates/task_detail.html(2 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
website/management/commands/create_xss_tasks.py (1)
website/models.py (4)
Labs(2458-2483)TaskContent(2510-2526)Tasks(2486-2507)update_total_tasks(2468-2475)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Run Tests
- GitHub Check: docker-test
🔇 Additional comments (1)
website/management/commands/create_xss_tasks.py (1)
51-57: Confirm MCQ option format matches template’s expectationThe template sets radio values via
value="{{ option.0 }}", which for a string uses its first character. Your options are like "A) …". That works, but it’s easy to break if formatting changes.Please verify that elsewhere in the app (other labs) options follow the same convention. If not, consider storing options as pairs so values are explicit, e.g.,
["A", "Reflected XSS"], and adjust the template accordingly.
49e7c33
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
website/templates/task_detail.html (1)
126-157: Fix unreachable CSRF branch and simplify conditional renderingThe nested condition inside the "SQL Injection" branch makes the XSS/CSRF label/placeholder paths unreachable there. As a result, for "Cross-Site Request Forgery" labs, the top-level else branch is taken and the CSRF-specific prompt is never shown (you get the generic one). Flatten the branching and add an explicit CSRF branch at the top level.
Apply this diff to replace the whole block with a flat, readable chain:
- {% if lab.name == "SQL Injection" %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2"> - {% if lab.name == "SQL Injection" %} - Enter your SQL injection payload: - {% elif lab.name == "Cross-Site Scripting (XSS)" %} - Enter your XSS payload: - {% elif lab.name == "Cross-Site Request Forgery" %} - Enter your CSRF attack code: - {% else %} - Enter your payload: - {% endif %} - </label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="{% if lab.name == 'SQL Injection' %}Enter your SQL injection payload here...{% elif lab.name == 'Cross-Site Scripting (XSS)' %}Enter your XSS payload here...{% elif lab.name == 'Cross-Site Request Forgery' %}Enter your CSRF attack code here...{% else %}Enter your payload here...{% endif %}"></textarea> - {% elif lab.name == "Cross-Site Scripting (XSS)" %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your XSS payload:</label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="Enter your XSS payload here... (e.g., <script>alert('XSS')</script>)"></textarea> - {% else %} - <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your payload:</label> - <textarea id="payload" - name="payload" - rows="4" - class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" - placeholder="Enter your payload here..."></textarea> - {% endif %} + {% if lab.name == "SQL Injection" %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your SQL injection payload:</label> + <textarea id="payload" name="payload" rows="4" class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" placeholder="Enter your SQL injection payload here..."></textarea> + {% elif lab.name == "Cross-Site Scripting (XSS)" %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your XSS payload:</label> + <textarea id="payload" name="payload" rows="4" class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" placeholder="Enter your XSS payload here... (e.g., <script>alert('XSS')</script>)"></textarea> + {% elif lab.name == "Cross-Site Request Forgery" %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your CSRF attack code:</label> + <textarea id="payload" name="payload" rows="4" class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" placeholder="Enter your CSRF attack code here..."></textarea> + {% else %} + <label for="payload" class="block text-sm font-medium text-gray-700 mb-2">Enter your payload:</label> + <textarea id="payload" name="payload" rows="4" class="shadow-sm focus:ring-[#e74c3c] focus:border-[#e74c3c] mt-1 block w-full sm:text-sm border border-gray-300 rounded-md p-3" placeholder="Enter your payload here..."></textarea> + {% endif %}Additionally, string-matching on lab.name is brittle (renames, i18n). Prefer a stable slug/type supplied by the backend, or pass label/placeholder from content.simulation_config.
🧹 Nitpick comments (2)
website/templates/task_detail.html (2)
179-179: Remove leftover empty container after removing navigationThis empty flex container serves no purpose and adds unnecessary DOM.
- <div class="mt-8 flex justify-between"></div> + {# navigation removed intentionally #}
126-157: Avoid hardcodinglab.namefor branching in the templateWe verified that the only identifiers on
Labsare thenamefield and there is noslug. While the three names (“SQL Injection”, “Cross-Site Scripting (XSS)”, “Cross-Site Request Forgery”) are seeded increate_initial_labs.pyand used in your management commands, branching on display names is brittle—any rename or typo will silently fall back to the generic branch.Consider one of the following refactors:
- Add a
slug = models.SlugField(unique=True)to theLabsmodel, backfill existing records, and switch your template toif lab.slug == "sql-injection"(and likewise for the others).- Or, encapsulate the label/placeholder logic in your view (or a small template tag) and pass explicit strings into the context, eliminating in-template name comparisons.
Locations to update:
website/models.py(addslugtoLabs)website/management/commands/create_initial_labs.py(populate the new slug)website/templates/task_detail.html(branch on slug or use injected labels)[optional_refactors_recommended]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting
📒 Files selected for processing (4)
website/management/commands/create_csrf_tasks.py(1 hunks)website/management/commands/create_sql_injection_tasks.py(0 hunks)website/models.py(0 hunks)website/templates/task_detail.html(3 hunks)
💤 Files with no reviewable changes (2)
- website/models.py
- website/management/commands/create_sql_injection_tasks.py
✅ Files skipped from review due to trivial changes (1)
- website/management/commands/create_csrf_tasks.py
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Run Tests
- GitHub Check: docker-test
Fixes: #4494
Summary by CodeRabbit
New Features
Style